Evan Schuman's StorefrontBacktalk

One of the most annoying parts of many a casual restaurant outing is at the end, when you just want to say “Check, please” and all wait staff seem to sense this and decide instead to join the Waitress Relocation Program.

Microsoft has decided to help (OK, they smelled money in those missing food servers) and created a device that permanently sits on the table. Redmond is backing this hardware that can take payment, print out a receipt and do it all without having to catch anyone’s eye. It allows the tip to be added (minus a deduction for subjecting you to the machine), and it can show various promotions. (OK, so having mandatory TV commercials when you’re dining out is probably not a good thing.) It also has a button to summon a manager if there’s an issue.…

The PCI Security Standards Council on April 15 officially rolled out version 1.1 of the Payment Application Data Security Standard (PA-DSS). The specifics of the standard were spelled out last November and this is just the expected formal unveiling.

This fall, the group said it will maintain a list of validated payment apps. Also this fall, the group is likely to introduce an entirely new version of the PCI specification. But that version is not expected to have any impact on which apps are considered compliant.…

Any security consultant will tell you that it's important to have a data classification scheme. Although it makes a nice spreadsheet, we have seen only a few leading-edge merchants and banks that actually attempt to enforce it and use it to drive access controls. Why? Taylor has concluded that it's for a single strategic reason: "Data classification is boring." Read more...

A DVD rental kiosk outfit has rolled out a kiosk that keeps track of orders and awards free videos for frequent shoppers. The idea of a kiosk that has a long-term memory and an active CRM component is a wonderful next step (OK, a baby step) for intelligent kiosks.

The new units from DVDPlay use E-mail addresses in lieu of a loyalty card. “By entering an E-mail address during the rental process, the stand-alone DVD rental machine’s patent-pending software recognizes the number of customer rental transactions and, after every tenth rental, generates a promotional code for a free movie that is automatically sent to the customer’s E-mail account,” said a statement issued by the company. …

"A good QSA would ask not only if an antivirus package existed or if a firewall appliance was installed or if a unique user ID policy was followed, but also how these were designed, architected, implemented, configured and monitored," Weise wrote. "A good QSA would ask to what security policy must applicable operational procedures adhere and whether anyone looks at the alerts and logs generated by the antivirus or firewall products."Read more...

With the exception of in-person pickups and cash-on-delivery, plus a handful of large-ticket items (specifically cars, motorcycles, aircraft, boats, caravans, trailers, commercial trucks, services, real estate and businesses) for sale, sellers will be required to offer eBay-owned PayPal as a payment method by May 21, in anticipation of the June 17 ban on anything else. Said eBay: "If we think these changes will significantly improve the buyer experience, we may expand them to additional segments of sellers or categories." Read more...

The $4.8 billion automotive aftermarket parts chain—which dubs itself the nation's second largest such chain, with 3,261 stores in 40 states, Puerto Rico and the Virgin Islands—said the breach appears to have impacted customers from 14 of its stores in Georgia, Ohio, Louisiana, Tennessee, Mississippi, New York, Virginia and Indiana. Read more...

McDonald's is launching iced coffee as part of some new menu options and "part of our objective was to create additional awareness," especially among the younger consumers who McDonald's assumes will be receptive to a mobile coupon campaign." Read more...

PCI DSS is famous for its level of detail, in laying out for merchants procedures for implementing and testing many different security controls. But PCI DSS does not tell merchants how they should actually manage all these alerts or which of these controls need to be integrated, and which of the procedures need to be automated.Read more...

When Best Buy removed annual fees from its bonus card, the company yielded about 10 times the number of shoppers opting to sign up for its rewards program, according to this Forbes.com story.

A location that gains a reputation as a “flat-screen store,” for example, is identified as one frequented by more people with disposable incomes. Hence, salespeople are trained to pitch complimentary products, like sound systems and attachments. Interesting story…. …

Focusing on recent improvements in refrigeration technology, the 115-store Piggly Wiggly is pledging to radically revamp its stores. The grocery chain is shaking up product positioning issues—all frozen foods are kept together, for example—that have been considered sacrosanct for decades.

“When you enter the Piggly Wiggly at The Market Common, you don’t see check-out lines. You don’t go down five aisles to get ingredients for one meal,” said Piggly Wiggly CEO David Schools. A statement said the chain will now “arrange food items based on how customers naturally look for them. Fresh, frozen and canned vegetables and fruit, for instance, will be in the same location, as will cereal and milk. One stop stations will offer complete meal solutions with items such as ground beef, hamburger buns, chips and beer grouped together for backyard grilling.” Will it work? Possibly. Then again, this is the same chain that strongly touted it’s support for biometric payment.…

Such claims are commonplace, but the VeriShield Protect from Verifone is making claims that—if ultimately proven true—would significantly advance retail payment security. The new unit uses Hidden Triple Data Encryption Standard (H-TDES) from a company called Semtek Innovation Solutions Corp.. It's hardware unit is designed to deactivate if anyone succeeds in opening the case, making the planting of physical data-capture devices more challenging. Read more...

covers a variety of uses (see the Patent's full text here as well as some illustrations that accompanied the federal filing), but its core functionality would require consumers to download a small applet to their phone, which would then be associated with a payment method plus a password and potentially some other authentication approach such as any form of biometrics. Password-only protection is the default scenario. Another piece of software would be installed in the retailer's POS system. Read more. Read more...

Whether it's leaving firewalls in learning mode or having database access controls that all but ignore the activity of authorized users--who may be capable of nastiness few cyber thieves could dream of--it's an amazingly risky approach. Read more...

Although the merchant behind the program—Chockstone—stresses a variety of security mechanisms, the nature of the program itself seems to fly in the face of PCI guidelines that discourage using credit card numbers for anything other than payment transactions, similar to the unsuccessful attempts to get American businesses to stop using Social Security numbers as defacto employee and customer identification numbers. Read more...

The service can also support Web searches—but that's hardly new—and is being positioned by Amazon as an easier way for consumers to make Amazon purchases. The transactions can be almost solely done via text, with an old-fashioned phonecall used to verify the purchase.Read more...

Nowhere is this myth more wrong—indeed, polar opposite wrong—than when dealing with security breach issues of U.S. retailers. I'm going to try and avoid using modern-day chains to illustrate good and evil. Regrettably, I think it's a safe bet that I am about two sentences away from failing that effort. Let's take TJX as an example. (Only one sentence. I was close, though.) Based on various SEC filings and court documents, it's clear that TJX engaged in a wide range of security procedures that were, to be charitable, less than diligent. But, as we've pointed out many times, the millions in expenses that TJX has had to spend had absolutely nothing to do with any alleged security sloppiness. Read more...

Was the Hannaford data breach isolated or was it part of a sweep of similar penetrations? A Vermont ski resort is reporting an almost identical breach of card information in transit in February and an official there was told by law enforcement “that they currently are looking into about 50 reported incidents of the same sort in the Northeast alone.”

Those new details–courtesy of a Computerworld story–suggest that this might soon become the norm. The Okemo Mountain Resort ski area in Vermont announced this week that data from more than 46,000 credit and debit card transactions may have been compromised during a system intrusion over a 16-day period in February. “We can tell you that this was a real-time theft,” said Okemo spokeswoman Bonnie MacPherson. “The information was being taken as the cards were being swiped.”…

TJX will pay as much as $24 million to cover databreach losses suffered by MasterCard banks, assuming 90 percent of the banks agree to the settlement offer, TJX and MasterCard announced on Wednesday. TJX last year announced the world’s worst payment data breach, which impacted some 100 million cards.

Participants “must agree not to seek or participate in any other recoveries that may be available to issuers and must also release MasterCard, TJX and TJX’s acquirers from all legal and financial liability associated with the TJX data breach, ” a joint statement said. Those banks have 30 days to whether to accept the offer. …

Although the coupon redemption rate has been steadily declining for at least 10 years, a new vendor survey suggests the recession may turn that around.

Of the 1,529 U.S. consumers who responded, 67 percent said they are much more likely, or somewhat more likely, to use coupons during a recession, according to the survey performed by ICOM Information & Communications. Technology is helping, though, with CRM doing better job targeting households and Web coupons finding new fans among the paper-repulsed young.…

Bankrupt Pay By Touch—officially using the name Solidus Networks—has sold off two key units for a total of $4.8 million.

Phoenix Check Cashing dropped $4.2 million to pick up Pay By Touch’s check-cash¬ing division, known as BioPay Paycheck Secure, according to The Nilson Report. Acculink paid $600,000 for ATM Direct, a unit trying to introduce PIN-based debit card payments for E-Commerce sites, the publication reported.…

This week brings the news that American Express is halting its ExpressPay keyfob, some six years after the payment giant started offering it. The program is expected to deactivate the last of its fobs by July. There are many reasons the fob may have died, but at least Amex—with six years of fob effort under its payment belt—can't be accused of not giving the fob enough time to work.Read more...

The Hannaford data breach included payment information that was partly encrypted and partly clear text—and it was all transmitted over a private fiber-optic cable, according to a Hannaford official quoted in the Wall Street Journal.

This information—on top of the reports that Trojan Horse software was installed on 300 servers in 300 Hannaford stores–is painting a picture of a retailer that seemed to be following accepted security procedures. The story reported that the cyber-thief created software “intercepted the information as it went back and forth over a cable to a transaction processor in Denver. It was then transmitted to an Internet service provider somewhere outside the U.S.,” according to Hannaford marketing VP Carol Eleazer, who added that “it took a team of about 30 forensics experts and information technologists more than 10 days of round-the-clock troubleshooting to discover the malware.”…

A new type of payment card forger is making the rounds, this time armed with a razor blade and very little money.

After the thief has been able to guess at random numbers and find a viable payment card, the culprit razors off the last few digits from a real payment card and KrazyGlues the guessed at numbers onto the card. He/she then scratches the magstripe to force the cashier to manually enter in the digits, according to this nicely-done story from the Oregonian newspaper.…

The data breach at Hannaford involved a Trojan Horse that was installed on servers at every one of its 300 grocery stores, according to Hannaford officials. The software intercepted card data at the POS and then periodically transmitted them “to an unnamed offshore Internet service provider.”

Those details come courtesy of a letter sent by Hannaford general counsel Emily Dickinson to Massachusetts Attorney General Martha Coakley and Governor Deval Patrick’s Office of Consumer Affairs and Business Regulation, according to Hannaford officials and a report in The Boston Globe, which quoted from the letter. The chain decided to replace all of the servers to make absolutely certain the malicious programs were removed from the network.…